59c5af5beaf80c4a079c5f25c8c3cafad230fa51397d964c6744b7258efcc47b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:48

Target

16e89a1f3b08626b5e8763ed8b153c42.exe
Size

260KB
MD5

16e89a1f3b08626b5e8763ed8b153c42
SHA1

074c464947d670eced0229322b2bdc3c24bf51d9
SHA256

59c5af5beaf80c4a079c5f25c8c3cafad230fa51397d964c6744b7258efcc47b
SHA512

6597d5cc10d77f28314d3c8aef69e0dc124a2fb3ae54ff24c6ccdc4c44c397f13fd09330a22e3d42223ee5fc9766daac3fe49f8784b103e7c20ae05aa0bfb313
SSDEEP

3072:a1CggRT30pUhL2s8QcPf49W87SM5HiU6Zdm/avCAa/OsREs0ZnVGNVsiEvuVDSgP:wgRSUhL2sVGQllHiU6ZdCFqhVeVHEv+H

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1540	2140	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2140	16e89a1f3b08626b5e8763ed8b153c42.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1540	2140	16e89a1f3b08626b5e8763ed8b153c42.exe	28
PID 2140 wrote to memory of 1540	2140	16e89a1f3b08626b5e8763ed8b153c42.exe	28
PID 2140 wrote to memory of 1540	2140	16e89a1f3b08626b5e8763ed8b153c42.exe	28
PID 2140 wrote to memory of 1540	2140	16e89a1f3b08626b5e8763ed8b153c42.exe	28

C:\Users\Admin\AppData\Local\Temp\16e89a1f3b08626b5e8763ed8b153c42.exe
"C:\Users\Admin\AppData\Local\Temp\16e89a1f3b08626b5e8763ed8b153c42.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 188
  2⤵
  - Program crash
  PID:1540